cloudfoundry / cloudfoundry/diego-release
[BBS] Log Client Certificate Identity Information in Access Logs
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 206
- Forks
- 228
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 9
Description
Proposed Change
As a security expert
I want to be able to map calls to API endpoints (e.g. /v1/actual_lrps/list) to a TLS client certificate by checking the access logs
so that during incident investigations, one can determine exactly which client certificate did what
Acceptance criteria
Client certificate information (common name, organizational unit, organization) are written to the access log file.
Related links
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing related PR 145 and the BBS access-log entry point for requests such as /v1/actual_lrps/list. Confirm how TLS client certificate identity is represented and verify that access logs expose the common name, organizational unit, and organization for each API call.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100